From aebabab7f3af4fe27e7dd36f64dc6c18bf92f059 Mon Sep 17 00:00:00 2001 From: ClearlyClaire Date: Fri, 25 Jul 2025 14:07:18 +0200 Subject: [PATCH] FEP-044f: Call out visibility/access control/privacy options to implementers (#659) This is non-normative, but highlights privacy-related pitfalls implementers could fall into. Co-authored-by: Claire Reviewed-on: https://codeberg.org/fediverse/fep/pulls/659 Co-authored-by: ClearlyClaire Co-committed-by: ClearlyClaire --- fep/044f/fep-044f.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fep/044f/fep-044f.md b/fep/044f/fep-044f.md index 81464b7..ac60cb4 100644 --- a/fep/044f/fep-044f.md +++ b/fep/044f/fep-044f.md @@ -419,6 +419,8 @@ Using a special class like `quote-inline` can be useful to hide redundant inform Servers that do not implementing the current FEP will still be able to quote the post without providing any dogpiling-reducing friction. There is unfortunately nothing we can do about that. However, servers which do implement the current FEP should refuse displaying those quotes, so implementing the control mechanisms of the current FEP remains worthwhile. +The current FEP does not specify behavior around the visibility of quoted posts, but implementations should pay special attention to not inadvertently expose the contents of a quoted post to users who are not allowed to see it. In particular, implementations should ensure that any restriction based on user blocks, or follow relationships are still respected. Likewise, implementations should pay attention so that any discoverability, searchability or privacy setting, such as FEP-5feb, are still respected. + Effectively revoking authorized quote posts relies on the participation of the quote poster's server to effectively reach the audience of the quote post. This means that an ill-intentioned server which obtained an authorization could deliberately refuse to forward the revocation. Still, the ability to revoke a quote post remains useful between well-intentioned servers, and opportunistic re-verification of quote approvals should also help with discovering that a quote authorization has been revoked, despite the potential lack of forwarding. By not adding a hash or copy of the reply in the `QuoteAuthorization` object, malicious actors could exploit this in a split horizon setting, sending different versions of the same activity to different actors. This is, however, already a concern in pretty much all contexts in ActivityPub, and enshrining that information in the `QuoteAuthorization` object would have many drawbacks: